Comment by studentrob | Hacker News Reader

Comment by studentrob | Hacker News Reader

Parent Full thread

> I’m not surprised when I see polls that say that Apple should turn over the information to the FBI

Grr. This poll was completely biased and it's being cited all over the place as if it were a good gauge of public opinion.

The question is framed as if Apple only needs to unlock the phone. It does not mention that Apple would need to write new software and alter its product. [1]

The real question is, should the DOJ be allowed to force Apple to create new software that enables the phone to be unlocked. That is the question that is being put to the courts, and that is the question that needs to be asked of the American people if this is to become an election issue.

The poll question:

"As you may know, the FBI has said that accessing the iPhone is an important part of their ongoing investigation into the San Bernardino attacks while Apple has said that unlocking the iPhone could compromise the security of other users’ information. Do you think Apple"

* Should unlock the iPhone (51) * Should NOT unlock the iPhone (38) * Don’t know/Refused (11)

[1] http://www.people-press.org/files/2016/02/2-22-2016-iPhone-r...

I really wish the poll questions included anything at all asking about whether people understood the potential negative consequences of simply "unlocking the phone". For example, "do you believe Apple that unlocking this phone would compromise security for other users?"

Yeah. The poll does a lousy job of ascertaining the respondent's knowledge. That also shows bias for the DOJ/FBI since most people probably aren't knowledgeable about such a recent case yet.

Another question asks the respondents to judge their own expertise on the subject:

> How much if anything, have you heard about a federal court ordering Apple to help the FBI unlock an iPhone used by one of the suspects in the San Bernardino terrorist attacks? Have you heard

* A lot (39) * A little (36) * Nothing at all (24) * Don’t know/Refused (1)

I don't, and neither does the developer of cydia https://news.ycombinator.com/item?id=11158036

>The problem I have is with stuff like their answer to the question "Could Apple build this operating system just once, for this iPhone, and never use it again?", which essentially is outright lying: the "master key" in question is their signing key, not some piece of trivial software they develop (and then sign) in order to automate this process for the FBI. Apple already has the only master key of relevance: that key already exists; the idea that the master key is something that they need to "build" and then would have to "protect" is them trying to divert attention from what is actually important.

>The world isn't somehow different once that software exists

The world is very different once compelled speech is accepted, i.e. when the government can force you to use a signing key to produce a digital signature expressing trust in software you didn't voluntarily write and don't actually trust.

I'm sure the government would be just as happy for Apple to hand over the key, which doesn't force them to say anything.

It's to Apple's benefit to be able to merely sign something, so it's a bad argument to complain about forced speech.

Some people are bending over backwards to tell us how easy this will be for Apple. Strangely, none of them are on the hook for that prediction...

Weakened firmware would be a master key. The only hope is that a device-ID check could be baked in well enough to prevent it from being repurposed, etc. In my experience, a hastily designed security feature in a rushed firmware update will always have bugs.

There is a ton of risk to the innocent owners of iPhones, and to everyone from this precedent, and most-importantly, very little benefit from cracking this specific work phone of a dead killer.

The government has failed to make a convincing case.

Every time any recent iPhone is updated, it needs a new signature from Apple specific to that device, and a nonce to prevent replay attacks. Without Apple's key, the firmware is useless.

With the ability to compel digital signatures under threat of imprisonment, you effectively have Apple's master key.

The point is that every use of it requires a judge to sign off on it. That means it can't be used by "rogue" government officials, nor will "hackers" be able to use the software, because the software is useless without a signature.

I will trust Apple over the government on computer security matters any day of the week.

Even better, when Snowden buys a smartphone, we'll know which one is truly securable by the user.

From an above commenter,

"Handing over the key is worse than being compelled to use it; that's perpetual compelled speech, where the government would be able to declare software trusted-by-Apple forever. Eroding public trust in digital signatures is an attack on the entire 21-century economy."

A judge signing off on compelled speech and conscripted development of software is still unconstitutional (and specifically excluded under CALEA). If the government wants a back door in to the cryptosystems of private companies, they should pursue this through the legislative process.

Handing over the key is worse than being compelled to use it; that's perpetual compelled speech, where the government would be able to declare software trusted-by-Apple forever. Eroding public trust in digital signatures is an attack on the entire 21-century economy.

The real question is: should private citizens have the right to engage in private communication that the government cannot tap? That's essentially the data being asked for here.

Sort of.

You need to understand that once you commit a crime, you lose many rights you previously had (e.g. to vote). Not to mention that once you're dead (as in the San Bernardino case), you arguably lose all of your rights.

Property rights are still observed for dead people. And copyrights. Taxes continue to be calculated after death. So not all your rights.

The problem isn't that the government wants to infringe on the rights of a deceased criminal. The problem is that by doing so, every citizens' rights are in jeopardy.

Basically Apple created the current problem by making it possible to push new firmware to a locked phone. I'm not saying that Apple is worse than industry standard, just that the backdoor already exists.

So what prevents the FBI from asking Apple to have a team visit the Apple offices, get access to all code that runs on the iPhone and the docs and signing keys?

The team will then unlock the phone and leave with nothing but the unlocked phone.

All of this, get Apple to appear as a third party witness already exists in the law.

I agree with you that a more secure device could have been created. However, Apple did not write this poll, and that's what I'm focused on in the above comment.

> So what prevents the FBI from asking Apple to have a team visit the Apple offices, get access to all code that runs on the iPhone and the docs and signing keys?

I believe the DOJ would like to set a precedent here of having Apple weaken its own security. If the US wins this case and Apple is compelled to write special software, then Apple may be expected to provide a back door to any other of its present or future devices. That is much more powerful than having the FBI grab source code and hack the system themselves. They'll simply expect Apple to do it for them.

The FBI doesn't just want to unlock one phone. They want a system to unlock all iPhones. This case is just a convenient way for the FBI to force Apple to comply with their greater goal.

The legal precedent set would compel Apple to do this for every phone the FBI brought them. The process of unlocking the phone doesn't matter. It's the precedent set that is at issue.

Are you advocating for the government positions here? It sounds like you are, but it's not 100% clear.

I'm saying the government framed it in a weird way. The court case compels Apple to act. That's clearly wrong.

However, Apple is a neutral third party that holds information needed in an investigation. And there are ways to use this information securely. And the phone is clearly connected to a crime.

So it should be easy for the government to formulate a request that Apple cannot refuse under the law.

Why the FBI asked for something else, I don't know.

What Apple should do now is as soon as possible to roll out a firmware upgrade that locks them out of all phones that are currently in use. Then next time, it will be impossible for Apple to help.

>>However, Apple is a neutral third party that holds information needed in an investigation.

No, they may have the technical ability to weaken a product they made, which may hold information needed in the investigation. They already provided the information they actually have access to (the iCloud backups).

If they are indeed forced to do this, I expect the market cap of AAPL will drop significantly (billions of dollars, most likely) to reflect the weakened security of their product. Is that a reasonable thing for the government to require of a neutral third party?

The whole conversation is being muddied by people who insist that every observation and line of thinking is a form of advocacy for one of two positions, and should be interpreted through this. Witness the responses to Gate's comments.

The situation is more nuanced than the loudest voices would want us to believe.

It would be helpful to identify the nuances you aren't seeing.

That's exactly why I'm asking the question - it's unclear.

Or put it another way, pretend Apple runs a storage facility. The FBI wants access to a particular storage locker, but Apple is refusing to cut the padlock on the door. Very few people would argue that Apple is justified in that situation. I'm personally not sure why digital privacy shouldn't follow the same laws as physical privacy.

By Apple giving itself the ability to unlock the phone (through a new firmware push) they now have to justify why they shouldn't use that ability. If Apple never had that ability, they could simply say "It isn't possible" and could never (legitimately) be accused of obstruction of justice. Apple put itself in this position.

It's harder than pushing a firmware. You need to write and validate a special firmware with a specific weakening of some measures, and then add a protection to lock it to that specific phone so it can't be used as a master-unlock and verify that. Because of how the FBI is pursuing this, Apple will have to take all the risk. If the update bricks the phone or fails to recover the data, Apple's reputation suffers.

As for storage lockers, like safe-deposit boxes, it's only reasonable for the government to ask the provider to open the locker/box because the business has the means for this. Non-payment results in eviction and probably "every day" they have a maintenance person sawing locks off. On the other extreme, Apple doesn't need to have a way to decrypt and evict your data for their general business so it's unreasonable to expect them to be able to provide this.

If the government wants this lock sawed off, it needs to do it itself. (Or pay a hardware-reverse engineering company do it for them.)

Not really. It's more like the FBI wants access to a particular storage locker and has the ability to open it, but wants apple to build a new kind of saw for that door so they can use it on other doors later.

I wonder why the FBI came out public with this request when the government does even worst secretly?

Reply on news.ycombinator.com